Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-44376CubeCart: Reflected XSS in Store Search Bar

Medium 6.1

In plain English

A medium-severity cross-site scripting in v6 from cubecart. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.7%top 46.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a logic flaw in classes/catalogue.class.php, user input is reflected without sanitization only when a search returns exactly one product. This flaw bypasses current filters, allowing an attacker to execute malicious JavaScript in the victim's browser, leading to session hijacking, site defacement, or phishing. This vulnerability is fixed in 6.7.0.

Affected products (as reported)

Vendor	Product	Versions
cubecart	v6	< 6.7.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/cubecart/v6/security/advisories/GHSA-gvcp-wpvp-c6f7 x_refsource_CONFIRM
https://github.com/cubecart/v6/commit/b9d03e20b9d0f443f8ea55fd834e348438e2cc0c x_refsource_MISC